add action for vulnerability testing

Penetration testing on a pygeoapi instance would be a valuable testing mechanism in a DevSecOps context.

[Zed Attack Proxy (ZAP)](https://www.zaproxy.org) could be a viable option, given it provides this functionality as GitHub Actions:

- https://github.com/zaproxy/action-api-scan
- https://github.com/zaproxy/action-baseline
- https://github.com/zaproxy/action-full-scan

We should also consider the [OWASP API Security Top 10](https://owasp.org/API-Security).

The result would be a GitHub Action (`.github/workflows/security.yml`) that would run some/all of the above.